React2Shell: 120,000+ Servers Vulnerable to Single-Request RCE Attack

React2Shell: 120,000+ Servers Vulnerable to Single-Request RCE Attack

Right now, over 120,000 servers running React are vulnerable to a single HTTP request that gives attackers full control. No password needed. 😬

CVSS score: 10.0 (maximum). Security researchers call it React2Shell. ⚠️

CRITICAL: If you patched early, you may STILL be vulnerable.

In the Matrix* of web development, there's a glitch* that's worse than you think. CVE-2025-55182 isn't just a vulnerability—it's a backdoor into your server that requires nothing more than a single HTTP request. No authentication. No password. Just one request, and the Agents* have full control.

What started as a security researcher's discovery on November 29 has become one of the most rapidly exploited vulnerabilities of 2025. Within hours of disclosure, state-sponsored threat actors began targeting React servers. Right now, over 120,000 vulnerable servers are still exposed, and the Agents* are actively exploiting them while most site owners remain unaware.

The Timeline: From Discovery to Global Exploitation

What Is React2Shell?

React2Shell (CVE-2025-55182) is a glitch* in the Matrix*—an unsafe deserialization vulnerability in React Server Components that turns your server into an open door. The "Flight" protocol that handles communication between browser and server doesn't properly validate incoming data, allowing Agents* to send specially crafted HTTP requests that execute arbitrary code on your server.

Translation: Send the right payload, get code execution on the server. No password. No authentication. Just one request, and the Agents* own your server.

Here's the part that makes this worse: Your app is vulnerable even if you don't use server functions. Just supporting React Server Components is enough. Default configurations are affected. A standard Next.js app created with create-next-app can be exploited with no code changes. One request. Full server compromise. The Agents* don't need to break in—they just need to knock on the right door.

The Patch Problem: A Glitch* in the Fix

Here's where it gets worse: The original fixes (19.0.1, 19.1.2, 19.2.1) were incomplete. In the Matrix*, sometimes the fix has its own glitch*.

On December 11, researchers discovered that the initial patches did not fully address the vulnerability. Versions 19.0.2, 19.1.3, and 19.2.2 were also found to be vulnerable, leading to a new CVE designation: CVE-2025-67779. The Agents* found a way through the incomplete patch.

New safe versions: React 19.0.3, 19.1.4, or 19.2.3

If you patched to the earlier versions thinking you were safe, you need to update again immediately. The glitch* wasn't fully patched, and the Agents* can still get in.

Affected Versions and Frameworks

Affected React Versions

• React 19.0 through 19.2.2 (all versions in this range)
• Safe versions: 19.0.3, 19.1.4, or 19.2.3

Affected Packages

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

Affected Frameworks

• Next.js 15.x and 16.x (App Router)
• React Router (when using React Server Components)
• Waku
• Redwood
• Any other framework using React Server Components

The Scale of Exploitation: Agents* in the Wild

In the Matrix*, when a vulnerability like this appears, the Agents* move fast. Multiple threat intelligence teams (AWS, Google, Microsoft, Cloudflare, Kaspersky, Sophos, Palo Alto, Trend Micro, Wiz, Huntress) observed widespread exploitation within hours of disclosure. This isn't a theoretical threat—this is happening right now, and the Agents* are actively compromising servers as you read this.

Who Are the Agents*?

In the Matrix*, not all Agents* are the same. According to threat intelligence reports, the Agents* exploiting React2Shell include both state-sponsored espionage groups and financially motivated cybercriminals deploying crypto miners and botnets. These aren't script kiddies—these are sophisticated threat actors with resources and infrastructure.

Multiple security vendors have identified state-sponsored actors from China and North Korea actively exploiting this vulnerability. These groups are targeting various sectors including finance, retail, logistics, IT, education, and government organizations. The Matrix* doesn't discriminate—if your server is vulnerable, you're a target.

Cloudflare observed some scans excluding Chinese IP ranges. Is that evidence of origin? Or exactly what a smart Agent* wants you to think? In the Matrix*, the Agents* exploit systems, but narratives exploit minds. The truth is often hidden behind layers of misdirection.

What the Agents* Do After Breaking In

Once the Agents* gain access through React2Shell, they don't just poke around. Researchers have found multiple malware families being deployed through this vulnerability. The post-exploitation activities are sophisticated and designed for persistence, lateral movement, and data exfiltration. This isn't a smash-and-grab—this is an operation designed to maintain long-term control of your infrastructure.

ZnDoor Remote Access Trojan

One of the malware families deployed is ZnDoor, a remote access trojan with these capabilities:

• shell: execute commands
• interactive_shell: full shell access
• explorer: list directories
• explorer_cat: read files
• explorer_upload / explorer_download: move files to and from attacker servers
• system: gather system information
• socket_quick_startstreams: start SOCKS5 proxy
• start_in_port_forward: enable port forwarding

KSwapDoor Advanced Backdoor

Another sophisticated payload is KSwapDoor. According to Palo Alto Networks: "It builds an internal mesh network, allowing compromised servers to talk to each other and evade security blocks. It uses military-grade encryption and features a 'sleeper' mode that lets attackers wake the malware with an invisible signal."

Other Observed Malware

Security researchers have documented numerous other malware families being deployed through React2Shell exploits:

• VShell - Remote access trojan
• EtherRAT - Remote administration tool
• SNOWLIGHT - Advanced persistent threat framework
• ShadowPad - Modular backdoor platform
• MINOCAT tunneler - Network tunneling tool
• HISONIC backdoor - Persistent access mechanism
• COMPOOD backdoor - Another persistence tool
• PeerBlight - Linux backdoor
• CowTunnel - Reverse proxy tool
• ZinFoq - Go-based implant
• BPFDoor - Advanced Linux backdoor
• Auto-Color - Post-exploitation framework
• Cobalt Strike - Commercial penetration testing framework (often used maliciously)
• Sliver - Open-source adversary simulation platform
• Mirai/Gafgyt variants - IoT botnet malware
• XMRig - Cryptocurrency mining malware

Cloud Credential Harvesting

Attackers are also harvesting cloud credentials from AWS, Azure, GCP, and Tencent Cloud to dig deeper into infrastructure. Once they compromise a server, they extract environment variables, configuration files, and credential stores to gain access to cloud environments.

Post-Exploitation Activities

Microsoft reports post-exploitation activity including:

• Reverse shells to Cobalt Strike servers
• Creating new admin users
• Installing RMM tools like MeshAgent
• Modifying authorized_keys for SSH persistence
• Establishing multiple backdoors for redundancy

Operation PCPcat

Researchers discovered "Operation PCPcat" which has already compromised 59,128 servers. They describe it as "intelligence operations and data exfiltration on an industrial scale."

How to Check If You're Vulnerable

Method 1: npm audit

Run this command in your project directory:

npm audit

If you see "Next.js is vulnerable to RCE in React flight protocol" or warnings about CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, or CVE-2025-67779, you need to patch NOW.

Method 2: External Testing

Use Assetnote's react2shell-scanner for external testing. This tool can check if your application is vulnerable from an external perspective, simulating how attackers would probe your servers.

Method 3: Version Check

Check your package.json and package-lock.json files:

• If you're using React 19.0.0 through 19.2.2, you're vulnerable
• If you're using Next.js 15.x or 16.x, check that you've updated to patched versions
• Review all dependencies that use React Server Components

How to Fix It

Immediate Patching

Step 1: Update React

Update to the LATEST patched versions:

• React: 19.0.3, 19.1.4, or 19.2.3

Run:

npm audit fix
npm update react@latest react-server-dom-webpack@latest react-server-dom-parcel@latest react-server-dom-turbopack@latest

Step 2: Update Next.js

If you're using Next.js, update to these patched versions:

• Next.js 14.2.35
• Next.js 15.0.7
• Next.js 15.1.11
• Next.js 15.2.8
• Next.js 15.3.8
• Next.js 15.4.10
• Next.js 15.5.9
• Next.js 16.0.10

npm update next@latest

Step 3: Verify the Fix

npm audit

Verify that no critical vulnerabilities remain.

Temporary Mitigation (If You Can't Patch Immediately)

⚠️ WARNING: This is NOT a permanent solution. Patch immediately.

As a temporary measure, you can block requests with "next-action" or "rsc-action-id" headers at the WAF (Web Application Firewall) level. However, this may break legitimate functionality and should only be used while you prepare to patch.

This mitigation should be considered a last resort while you work on applying the proper patch. It does not address the root cause and may be bypassed by sophisticated attackers.

Why This Glitch* Is So Dangerous

1. No Authentication Required

The Agents* don't need credentials, API keys, or any form of authentication. A single HTTP request to the right endpoint is all it takes. In the Matrix*, this is like having a backdoor that doesn't even require a key.

2. Default Configuration Vulnerability

Standard Next.js apps created with create-next-app are vulnerable out of the box. No custom code or configuration is needed to be exploitable. The glitch* is built into the default setup, meaning thousands of developers have unwittingly deployed vulnerable servers.

3. Broad Attack Surface

Any application using React Server Components is potentially vulnerable, even if you're not actively using server functions. The mere presence of React Server Components support creates the attack surface. The Agents* don't care if you're using it—they care if you're supporting it.

4. Rapid Exploitation: The Agents* Move Fast

The timeline tells the story. Public disclosure to active exploitation: hours, not days. State-sponsored actors began exploiting within hours of patch release, demonstrating both the severity and the ease of exploitation. In the Matrix*, when a vulnerability like this appears, the Agents* don't wait. They act immediately.

5. Incomplete Initial Patches: A False Sense of Security

The original patches didn't fully address the vulnerability, leading to a second round of patches. Many organizations that patched early remained vulnerable, creating a false sense of security. This is the danger of incomplete fixes—you think you're safe, but the Agents* can still get in.

Best Practices Going Forward

1. Keep Dependencies Updated

Regularly update your dependencies and monitor for security advisories. Set up automated dependency scanning and alerts for critical vulnerabilities.

2. Implement WAF Rules

While not a substitute for patching, Web Application Firewalls can help detect and block exploitation attempts. Monitor for unusual patterns in HTTP requests.

3. Monitor for Indicators of Compromise

Look for:

• Unusual network connections
• Unexpected file modifications
• New user accounts or SSH keys
• Unusual process execution
• Suspicious outbound network traffic

4. Implement Least Privilege

Ensure that your applications run with minimal required privileges. This limits the damage attackers can do even if they successfully exploit a vulnerability.

5. Regular Security Audits

Conduct regular security audits of your applications and infrastructure. Use both automated tools and manual reviews to identify vulnerabilities before attackers do.

Lessons Learned: Surviving in the Matrix*

The React2Shell vulnerability demonstrates several critical lessons for surviving in the Matrix*:

1. Speed of Exploitation: The Agents* Move Fast Critical vulnerabilities are being exploited within hours, not days or weeks. Your patching window is smaller than ever. In the Matrix*, hesitation means compromise.
2. Verify Patches Work: Trust But Verify Even official patches can be incomplete. Always verify that patches actually resolve the vulnerability, especially for critical issues. Don't assume you're safe just because you patched.
3. Default Configurations Matter: The Glitch* Is Built-In Secure by default should be the norm. Vulnerabilities in default configurations affect every user. The Agents* know this, and they exploit it.
4. State-Sponsored Actors Are Fast: Advanced Agents* Nation-state actors monitor security advisories and begin exploitation almost immediately. These aren't script kiddies—they're sophisticated Operators* working for nation-states, and they move with precision.
5. Supply Chain Risk: One Glitch*, Millions Affected Vulnerabilities in popular frameworks affect millions of applications. Supply chain security is critical. One vulnerability in a popular framework can compromise thousands of sites overnight.

Conclusion: The Glitch* in the Matrix*

CVE-2025-55182 (React2Shell) represents one of the most critical and rapidly exploited vulnerabilities of 2025. With a CVSS score of 10.0 and active exploitation by state-sponsored Agents*, this is not a theoretical threat—it's happening right now to over 120,000 exposed servers. The Agents* are active, and they're compromising systems as we speak.

If you're running React Server Components or Next.js, check your versions immediately. Update to React 19.0.3, 19.1.4, or 19.2.3, and ensure Next.js is updated to the latest patched version. Don't assume that an earlier patch protected you—the initial patches were incomplete, creating a false sense of security that the Agents* can exploit.

In the Matrix* of web security, vulnerabilities like React2Shell are the glitches* that the Agents* exploit before you even know they're there. The sun never sets in the digital world, and the Agents* never sleep. They're scanning, probing, and compromising vulnerable servers 24/7. The only defense is staying ahead: patch quickly, verify patches work, and monitor for compromise.

The timeline from disclosure to exploitation was measured in hours. Your response time should be measured in minutes. The Agents* are moving fast. You need to move faster.

---

Frequently Asked Questions

I already patched to React 19.0.1, 19.1.2, or 19.2.1. Am I safe?

No. The original patches were incomplete. You need to update to React 19.0.3, 19.1.4, or 19.2.3. The earlier patched versions were found to still be vulnerable (CVE-2025-67779).

I don't use React Server Functions. Am I still vulnerable?

Yes. If your application supports React Server Components at all, you're vulnerable. You don't need to actively use server functions—just having React Server Components support enabled is enough.

I'm using Next.js. What version do I need?

Update to Next.js 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, or 16.0.10. Run npm update next@latest to get the latest patched version for your release line.

Can I block this at the WAF level?

You can temporarily block requests with "next-action" or "rsc-action-id" headers, but this is NOT a permanent solution and may break legitimate functionality. Patch immediately instead.

How do I know if I've been compromised?

Look for indicators like unusual network connections, unexpected file modifications, new user accounts, suspicious outbound traffic, or unexpected processes. Consider engaging a security professional for a forensic analysis if you suspect compromise.

What CVSS score does this have?

CVE-2025-55182 has a CVSS score of 10.0, which is the maximum severity rating. This indicates the highest possible severity level.

Are other frameworks affected besides Next.js?

Yes. Any framework using React Server Components is potentially affected, including React Router, Waku, and Redwood. Check with your framework's documentation for specific patching instructions.

How quickly was this exploited?

Exploitation began within hours of the patch release on December 3. Multiple threat intelligence teams confirmed active exploitation by December 5, with state-sponsored actors among the earliest exploiters.